MiCA & regulation simply explained

MiCA doesn’t regulate Bitcoin – it regulates the companies you buy and store bitcoin through. Whether a provider is licensed, you can check yourself in the ESMA register.

Rules for providers, not for Bitcoin

MiCAGlossaryMiCA (Markets in Crypto-Assets Regulation)The EU regulation on markets in crypto-assets. Since 30 December 2024, exchanges, brokers and custodians in the EU have needed authorisation; the last transitional period ended on 1 July 2026. MiCA regulates providers, not Bitcoin itself.On the learning path: Stage 4 · Step 2 – Choosing a provider →In the glossary →× is the EU Regulation on markets in crypto-assets (Regulation (EU) 2023/1114). It has applied in full since 30 December 2024.^[1] Anyone providing crypto-asset services on a commercial basis in the EU needs a licence. Banks and investment firms can instead notify their supervisor of the offer in advance.^[1] Providers already operating under national law could continue without a MiCA licence until 1 July 2026 at the latest^[1], in Germany only until 31 December 2025.^[8]

MiCA lists ten crypto-asset services. Three matter most to you: custody of crypto assets for customers, exchange for funds (buying and selling for euros) and transfer on behalf of customers.^[1] A licensed company is called a crypto-asset service providerGlossaryCASP (crypto-asset service provider)A company that professionally provides crypto-asset services to customers – such as trading, exchange, custody or transfers. In the EU, every CASP needs an authorisation under MiCA.On the learning path: Stage 4 · Step 2 – Choosing a provider →In the glossary →× (CASP).

You don’t need any permission to buy, hold or self-custody bitcoin.

Who’s who?

A provider doesn’t need a licence from your own country. With a MiCA licence from one EU member state, it may operate throughout the EU after prior notification (the EU passport).^[5] It must have its registered office in an EU member state.^[1] What counts, then: it is licensed, and your country is among the countries it has notified.

How to check a licence yourself

ESMA expressly recommends looking up your provider in the register.^[4] The short version is in Choosing the right provider. Here you’ll see how to read a register entry.

Step 1: Find the legal entity

The register lists the company behind a brand, not the brand. You’ll find it in the legal notice (imprint), in the terms and conditions or in the app under ‘Legal’. The screens show a fictional ‘Example exchange’.

Step 2: Look it up in the ESMA register

ESMA publishes its interim MiCA register as CSV files and updates it weekly. You need the file ‘Crypto-asset service providers’ (CASPS.csv).^[2] Open it in a spreadsheet program or text editor and search for the company name. On 24 September 2026 it listed around 360 providers, just under 100 of them from Germany (our own analysis).^[3]

New notifications from national authorities don’t appear there immediately.^[2] Providers licensed by BaFin are also listed in BaFin’s company database and in the Federal Gazette (Bundesanzeiger).^[5]

Step 3: Read the entry

The key columns, using the made-up Example exchange:^[3]

One brand can have several companies behind it. KrakenProvider · ExchangeKrakenLarge crypto exchange with an EU licence from Ireland: simple in-app buying or an order book, withdrawals via Lightning too.Licence: MiCA (Central Bank of Ireland) · reviewed Sept 2026Costs: App 1% plus spread; Kraken Pro 0.40% maker / 0.80% taker (as of Sept 2026)On the learning path: Stage 4 · Step 2 – Choosing a provider →Our profile →AdVisit Kraken* (paid link, opens in a new window)on kraken.com*Paid link: if you sign up or buy through it, we earn a commission. Your price stays the same. How we make money →18+ · Crypto assets are highly volatile; you could lose all your money. No deposit protection.×, for example, is registered with two Irish companies: one operates the trading platform, the other holds customers’ crypto assets and exchanges them for euros (as of 24 September 2026).^[3]

Step 4: Cross-check

ESMA also keeps a list of non-compliant providers.^[2] If your provider is on it, that is a clear stop signal. If it isn’t, that proves nothing: on 24 September 2026 the list had 173 entries, 164 of them from the Italian supervisor (our own analysis).^[2] BaFin also regularly warns about series of websites that collect data through contact forms and pass it on to unauthorised trading platforms.^[6]

What a licence does for you – and what it doesn’t

MiCA’s obligations for licensed providers include:^[1]

• Segregated custody: customers’ bitcoin must be kept separate from the provider’s own holdings, on the blockchain too, and legally separate from its assets, so that its creditors cannot reach them in an insolvency.
• No dipping into customer funds: customer assets may not be used for the provider’s own account.
• Euros at a bank: customer funds in euros must be with a bank or central bank by the end of the following business day at the latest, in accounts separate from the provider’s.
• Liability: if customer assets are lost through an incident attributable to the provider, it is liable – up to their market value at the time of the loss.

In Germany, § 45 KMAG adds that crypto assets an institution holds in custody for you are deemed to belong to you – including your share of pooled holdings. This doesn’t apply if you have allowed them to be used for the account of the provider or third parties.^[7] In an insolvency they can therefore be separated out, but that can take time. As we understand it, this rule mainly applies to providers based in Germany; for providers from other EU member states, MiCA’s segregation duty is what mainly counts. Exceptions, costs and lessons from earlier collapses are covered in Understanding custody.

No deposit guarantee for bitcoin

The statutory deposit guaranteeGlossaryDeposit guarantee (deposit protection)Statutory protection for bank deposits: up to €100,000 per person and bank if the bank goes bust. It generally doesn’t cover bitcoin – and neither does investor compensation.On the learning path: Stage 5 · Step 1 – Understanding custody →In the glossary →× protects bank balances up to €100,000 per customer and bank. According to BaFin, crypto assets are generally not covered – unless a crypto asset counts as a security or fund units are involved.^[9] So bitcoin held with a provider has no such protection. How your euro balance with the provider is protected is set out in its customer information.

A licence also doesn’t protect you from price falls, isn’t a seal of approval for low fees or good service and doesn’t guarantee that you can withdraw to your own wallet. It is a minimum requirement, not a recommendation. More criteria are in Choosing the right provider.

Travel Rule: why the exchange asks about your wallet

Since 30 December 2024, the revised EU Transfer of Funds Regulation, known as the Travel RuleGlossaryTravel Rule (Transfer of Funds Regulation)An EU rule requiring crypto providers to send details of the sender and recipient with transfers. Since 30 December 2024, for more than €1,000 from or to your own wallet, the provider also checks that the address is yours.On the learning path: Stage 5 · Step 4 – First withdrawal →In the glossary →×, has applied: information on the sender and recipient must accompany a transfer, much like with a bank transfer.^[10]

You notice this when you withdraw to a self-hosted address: the provider must record details about you and the recipient. For more than €1,000, it must also establish whether the address belongs to you or is controlled by you. The same applies if you send more than €1,000 from a self-hosted wallet to your provider.^[10] In practice this is done, for example, with a signed message from your wallet or a small test transfer. It is routine, not a suspicion against you. The steps are shown in Your first withdrawal to your own wallet.

AMLR from 2027: no anonymous accounts at providers

From 10 July 2027, the EU Anti-Money Laundering Regulation, AMLRGlossaryAMLR (EU Anti-Money Laundering Regulation)An EU regulation against money laundering that applies from 10 July 2027. It bans anonymous accounts at banks and crypto service providers and caps cash payments in trade at €10,000. Self-custody of bitcoin remains permitted.In the glossary →×, applies directly in all member states.^[11] Two points matter for Bitcoin:

• No anonymous crypto accounts: banks, financial institutions and crypto-asset service providers may not keep anonymous crypto-asset accounts, nor accounts that anonymise or heavily obscure transactions.^[11]
• Self-hosted addresses: providers must assess the money-laundering risk of transfers to and from such addresses and take suitable measures, for example asking for more information on where the crypto assets come from and where they go.^[11]

If you are already registered with a licensed provider using your ID, little changes. But expect it to ask where deposits from your wallet come from – so keep proper records of purchases and transfers. Self-custody remains allowed: according to the recitals, the ban does not apply to providers of hardware and software for self-hosted wallets, as long as they have neither access to nor control over the wallets.^[11] More in Privacy with Bitcoin.

If a provider isn’t licensed

According to ESMA, unlicensed providers have had to stop taking on and marketing to new customers immediately since 1 July 2026 and wind down their EU business in an orderly way. Their customers don’t enjoy MiCA’s protection, including the protection of client assets. ESMA advises them to act promptly and move their crypto assets to a licensed provider or to their own wallet. Providers are to set a deadline after which remaining positions are closed automatically – so read their notices carefully.^[4] When transferring, double-check every address and test with a small amount first.

Companies from non-EU countries may only serve customers in the EU without a licence if those customers approach them exclusively on their own initiative. If the company – or someone on its behalf – markets its services in the EU, this exception does not apply.^[1]

Example: Binance

Binance withdrew its licence application in Greece on 24 June 2026.^[12] Shortly afterwards, it told EU customers it would no longer accept new registrations and would restrict its services; according to media reports, it intends to apply for a licence in France.^[13] Binance was not in ESMA’s register of licensed providers on 24 September 2026 (our own check).^[3]

That is why we don’t link to Binance: we only include exchangesTermExchange (crypto exchange)A trading platform where buyers and sellers trade bitcoin with each other via an order book.On the learning path: Stage 4 · Step 2 – Choosing a provider →In the glossary →AdLicensed providers with a paid linkProviders from our comparisonKrakenExchange · MiCA (Central Bank of Ireland)Visit Kraken* (paid link, opens in a new window)BitvavoExchange · MiCA (AFM, Netherlands)Visit Bitvavo* (paid link, opens in a new window)CoinbaseExchange · MiCA (CSSF, Luxembourg)Visit Coinbase* (paid link, opens in a new window)All 7 compared – including non-partners →*Paid link: if you sign up or buy through it, we earn a commission. Your price stays the same. How we make money →18+ · Crypto assets are highly volatile; you could lose all your money. No deposit protection.× and buying apps with a MiCA licence – whether they offer only Bitcoin or other crypto assets too (see our methodology). This says nothing about the platform’s technology or security. If Binance obtains a licence, we will assess it like any other provider. Unlicensed P2P marketplaces such as BisqProvider · ExchangeBisqDecentralised open-source exchange for person-to-person trading – no account, no identity check, no custody.No licence – open-source software without an operating company · reviewed Sept 2026Costs: Bisq 1: 0.15% maker / 1.15% taker in BTC; Bisq Easy: no trading fee … (as of Sept 2026)On the learning path: Stage 4 · Step 1 – Ways to get Bitcoin →Our profile →Official website ↗× or Hodl HodlProvider · ExchangeHodl HodlBitcoin-only P2P marketplace: trade directly with other people through an escrow, with no identity check.No licence in the EU – not listed in the ESMA register · reviewed Sept 2026Costs: 0.75% per trading party, minimum fee usually up to $5; plus network fees (as of Sept 2026)On the learning path: Stage 4 · Step 1 – Ways to get Bitcoin →Our profile →Official website ↗× are only mentioned as a labelled alternative, without an affiliate link.

What’s next?